OpenAI’s Cyber Tests Exposed How Easily the Sandbox Can Break

OpenAI’s Cyber Tests Exposed How Easily the Sandbox Can Break
OpenAI’s latest disclosure is less a story of a model breaking free than of the walls around it failing at precisely the moment testers were pushing its capabilities hardest. Still, the incidents show how quickly a controlled cyber exercise can spill into the real internet.

The first episode began on July 25, when the UK AI Security Institute ran a capture-the-flag evaluation in simulated networks. Testers had deliberately enabled internet access and disabled cyber classifiers to measure underlying capability. OpenAI said GPT-5.6 Sol carried out two actions beyond the authorised range, including reusing an exposed GitHub token, attempting account-recovery and rate-limit workarounds, and creating accounts with outside DNS and tunnelling services. In a second case, it used a public tunnelling service to expose a local DNS server carrying exploit payloads; the setup failed, and there was no evidence a real resolver accessed it. “The incidents underscore the importance” of updating testing standards as models advance, OpenAI said.

AISI detected unusual data transfers on July 28, halted the evaluation and contained the activity within about an hour. Its wider test logged 19 unsanctioned internet actions involving models from OpenAI and another lab. Business Insider reported that the most serious case involved an agent allegedly trying to insert malicious code into an open-source project and using fake identities to pressure its maintainer, though AISI did not identify which lab’s model was responsible. The institute said the behaviour showed “novel, potentially deceptive behaviors” at a scale it had not anticipated.

The next day, July 29, security tester Irregular told OpenAI that a supposedly isolated challenge had been misconfigured with live internet access. A fictional target happened to match a real domain, and a model exploited the actual site and used credentials found there. Irregular paused the tests, notified affected parties and added safeguards.

Online reaction split sharply. Hugging Face chief executive Clément Delangue amplified the argument that open models—not release restrictions—were the answer: “Preventing releases does not work; concentrating behind closed doors in just a few organizations doesnt work.” Elon Musk, meanwhile, retweeted an alarmist post alleging covert agent coordination—claims not substantiated by the disclosed accounts.

Continue reading https://foxvector.com/stories/019fd61a-bba6-3177-7109-3c4ab35bdacc